From app to answer
Four checks between a request and your data
- Your app asks; the person consentsOAuth2 · PKCE S256
A token carrying only these scopes
- channels:read
- messages:read
- messages:write
- reactions:write
- users:read
- tasks:read
- tasks:write
- anything else → refused
- Operations opened to tokensAnswer as the scopes allow401Everything elseHowever senior the owner
Every token expires
90 days by default1 day365 days
- How do I know the documentation matches the software?
- The OpenAPI 3.1 document is generated from the server’s route definitions and checked on every change, so it cannot drift from the API. The public reference is rendered from the same document.
- Can a third-party app ask for access?
- Yes, through OAuth2. The person sees a consent screen naming the scopes, approves them, and the app gets a token that acts within them. Public clients use PKCE; partner apps are reviewed by the operator before organisations can install them.
- Description
- OpenAPI 3.1, generated from the server
- Reference
- A public OpenAPI reference
- Apps
- OAuth2 authorisation code with PKCE, consent per user
- Scopes
- A closed vocabulary; an unknown scope is refused, not ignored
- Expiry
- Mandatory, one to 365 days, ninety by default
- Storage
- A hash of the token, never the token
- Reach
- Only operations explicitly opened to tokens
What it does not do
The edges, before you find them
- No published client library yet: call the endpoints or generate a client from the OpenAPI document.
- Tokens reach a deliberately small part of the surface, growing over time.
- Outgoing webhooks carry identifiers, never message content; read it through the API.
- Nothing in the API can read an end-to-end encrypted room, whatever the scope.
- Rate limits are per organisation, so a busy integration shares a budget with people.
FAQ
The API: questions
- Yes. Enclessa exposes a REST API described by an OpenAPI 3.1 document that is generated from the server itself and checked automatically on every change. The public API reference is at enclessa.app/docs/api.
- With an access token. Any member can mint a personal access token from account settings, and an administrator can mint a token for a bot account. Each token carries scopes from a closed vocabulary and must expire within a year.
- Always. Expiry is mandatory, between one and 365 days, and defaults to ninety. There is no non-expiring token.
Bring your team over this afternoon
Free for up to 10 people, with encrypted direct messages and video calls. No payment card, no time limit, no server to run.
For businesses and organisations only — not available to consumers.